Enable or Disable Super Admin in Windows 11: Every Method

To enable the built-in Administrator account (the “super admin”) in Windows 11, open an elevated Command Prompt and run net user Administrator /active:yes. To disable it, run net user Administrator /active:no. But here is the counterintuitive part that most guides skip entirely: the built-in Administrator has no password by default and bypasses all User Account Control prompts — it is the most powerful and the least protected account on the machine simultaneously. When you enable it, anyone who can reach the login screen can sign in as Administrator without entering anything. The account exists on every Windows 11 installation, is hidden by default, and was disabled by Microsoft precisely because it’s a security nightmare. If you enable it, the first command after /active:yes must be setting a password — not later, not “I’ll get to it,” now.

“Super admin” is the internet’s name for what Microsoft calls the built-in Administrator account — a local account that exists on every Windows installation, is disabled by default, and has powers that a regular admin account does not. When enabled, it bypasses User Account Control (UAC) entirely, meaning no “Do you want to allow this app to make changes to your PC?” prompts. It runs every application with full administrative rights at all times. This is different from a standard user account that you’ve promoted to administrator, which still gets UAC prompts. The terminology confuses people because “super admin” is also a concept in Google Workspace (a cloud role, not a Windows feature) and WordPress (a multisite role). This page covers the Windows version: the built-in Administrator, how to enable it, how to secure it, and how to turn it off when you’re done.

Jake’s customer this week had a friend “fix” their PC by enabling the built-in Administrator, using it to install some software, and then leaving it on. The customer’s twelve-year-old found the Administrator account on the login screen, clicked it, and was in — no password, no PIN, no barrier. He installed three browser toolbars and a Minecraft mod that turned out to be adware. The most powerful account on the machine had zero protection. Jake’s fix was one command, but the lesson was the security conversation that followed. Ethan’s reaction was immediate: “Microsoft disabled this account for a reason. It has no password. It can’t be locked out. It bypasses UAC. When you enable it, you’ve turned off every safety mechanism Windows has. If you need it — and sometimes you genuinely do — the password comes first.”

What the “Super Admin” Actually Is (And Why It’s Different From a Regular Admin)

Every Windows 11 installation has two categories of administrative account, and the difference matters:

• Regular administrator accounts — the account you created during Windows setup, or any account you’ve promoted to administrator. These accounts have admin rights but still receive UAC prompts. Windows asks “Do you want to allow this app to make changes?” and requires your password or PIN to confirm. This is the safe design: you have the power, but Windows double-checks before each use.
• The built-in Administrator — a hidden, disabled-by-default account that Microsoft creates on every installation. It exists as a recovery mechanism for cases where all other admin accounts are broken. When enabled, it runs everything with full admin rights at all times, with no UAC prompts, no lockout policy, and no password by default. It cannot be deleted — only disabled.

The reason the built-in Administrator is so dangerous when enabled: User Account Control does not apply to it by default. A regular admin account gets UAC prompts because Windows treats it as a standard user that can elevate when needed. The built-in Administrator is treated as a permanently elevated account — every process it launches runs with full admin rights from the start. Microsoft calls this “Admin Approval Mode” for the built-in Administrator, and it’s disabled by default, meaning the super admin operates with zero friction.

“So the super admin is like a regular admin, except Windows never double-checks anything?” Jake asked.

“And it has no password by default, and it can’t be locked out, and it never hides from the login screen once enabled,” Ethan said. “Regular admin is a licensed driver with seatbelts and airbags. Super admin is a licensed driver who removed the seatbelts because they find them annoying. Same road, different odds.”

Enable the Built-in Administrator via Command Prompt (The Standard Method)

This method works on all editions of Windows 11 and Windows 10 — Home, Pro, Enterprise, Education. The command is a single line:

1. Right-click Start and select Terminal (Admin) (or Command Prompt (Admin)). Accept the UAC prompt. You need to be signed in as an administrator for this to work.
2. Type the following command and press Enter:

net user Administrator /active:yes

3. If the command succeeds, you see “The command completed successfully.” No restart is required — the Administrator account is immediately active.
4. Set a password right now (next section). The account has no password by default.

PowerShell Equivalent

If you prefer PowerShell (or if CMD isn’t working for you), the equivalent command:

Enable-LocalUser -Name "Administrator"

Run from an elevated PowerShell session. This does the same thing as the net user command — enables the built-in Administrator. No restart required.

Enable via Local Users and Groups (The GUI Method, Pro and Above)

Windows 11 Pro, Enterprise, and Education include a management console called Local Users and Groups (lusrmgr.msc). Windows 11 Home does not include this tool — Home users must use the Command Prompt or PowerShell methods above.

1. Press Win + R, type lusrmgr.msc, and press Enter. The Local Users and Groups console opens.
2. In the left tree, click Users. The right pane lists every local account.
3. Find Administrator in the list (it has a down-arrow icon, indicating it’s disabled).
4. Double-click Administrator to open its Properties.
5. On the General tab, uncheck “Account is disabled.”
6. Click Apply, then OK.
7. Set a password (next section) — the account is now enabled and passwordless.

The lusrmgr.msc tool also shows other useful information: whether the password is set to never expire, whether the account is locked out (the built-in Administrator cannot be locked out), and group memberships. The built-in Administrator is always a member of the Administrators group.

Set a Password IMMEDIATELY (The Step Every Guide Skips)

The built-in Administrator account has no password by default. This is not a quirk — it’s why Microsoft disables the account. If you enable it and don’t set a password, you’ve created a blank-password backdoor into your own PC. Anyone at the login screen can click the Administrator account and be signed in with full admin rights in three seconds.

To set a password, run this command from an elevated Command Prompt immediately after enabling:

net user Administrator YourStrongPasswordHere

Replace YourStrongPasswordHere with a password that meets your security requirements. There is no confirmation prompt — the command sets the password immediately. If you prefer the GUI, you can also set the password through lusrmgr.msc (right-click Administrator → Set Password) or through the Settings app (Settings → Accounts → Family & other users → select the Administrator → Change password).

Disable the Built-in Administrator (The Cleanup Step)

When you’ve finished using the super admin account — the recovery is done, the software is installed, the test is complete — disable it. The account cannot be deleted, but it can be returned to its default state:

1. Sign out of the Administrator account.
2. Sign in to your regular admin account.
3. Open Terminal (Admin) and run:

net user Administrator /active:no

Or in PowerShell: Disable-LocalUser -Name "Administrator". Or through lusrmgr.msc: double-click Administrator → check “Account is disabled” → Apply → OK.

The account is now hidden from the login screen again, the blank-password backdoor is closed, and the UAC bypass is no longer reachable. The password you set persists — if you re-enable the account later, you’ll need that password. This is fine and expected: it means the account has at least some protection even if someone else enables it.

Standard Admin vs Built-in Administrator: The Real Differences

The search phrase “super admin vs admin” is one of the most common in this topic, and the answer is more nuanced than most guides suggest:

The practical takeaway: a standard admin account is the right tool for 99% of use cases. You have the power, and Windows double-checks each use. The built-in Administrator is the right tool for the 1% — when you’re locked out, when you’re recovering a corrupted profile, when you’re in Safe Mode and need unfettered access. Using it as your daily driver is like carrying a fire extinguisher instead of a water bottle. The capacity is there; the ergonomics are terrible.

Make a Regular Account an Administrator (The Safe Alternative)

If the goal is “give this person admin rights” rather than “unlock the hidden super admin,” promote the account through Settings — this is the safe, documented path:

1. Open Settings (Win + I) → Accounts → Family & other users.
2. Under “Other users,” find the account you want to promote.
3. Click the account, then click Change account type.
4. In the dropdown, change Standard User to Administrator.
5. Click OK. The account now has admin rights (with UAC prompts, as designed).

This approach keeps UAC active, keeps the account password-protected, and keeps account lockout policy in effect. For almost every scenario where someone asks “how to make my account admin,” this is the correct answer — not enabling the hidden Administrator.

When You’ve Lost All Admin Accounts (The Emergency Fix)

The search cluster “lost admin account windows 11” and “no admin account on windows 11” describes a specific emergency: the only admin account on the PC is corrupted, disabled, or has a forgotten password, and every remaining account is a standard user. This is the scenario the built-in Administrator exists for:

1. Restart the PC and interrupt the boot three times to trigger the Windows Recovery Environment (WinRE). (Or hold Shift and click Restart from the sign-in screen.)
2. Navigate to Troubleshoot → Advanced options → Command Prompt.
3. In the WinRE Command Prompt, determine the Windows drive letter (it may not be C: in WinRE — try C:, D:, E: and use dir to find the Windows folder).
4. Run the same command: net user Administrator /active:yes
5. Restart the PC normally. The Administrator account is now available at the login screen.
6. Sign in as Administrator (no password if this is the first activation), set a password immediately, and use the account to repair your broken admin profile or create a new admin account.
7. Disable the Administrator account when done.

Note: the net user command in WinRE targets the offline Windows installation on the drive you identified. If the command reports an error, verify you’re using the correct drive letter for the Windows installation.

The IT Admin Corner: Managing the Built-in Administrator at Scale

Group Policy: Admin Approval Mode for the Built-in Administrator

Computer Configuration → Administrative Templates → Windows Components → User Account Control → “Admin Approval Mode for the Built-in Administrator account.” When enabled, this policy forces UAC prompts for the built-in Administrator, closing the biggest security gap. The recommended state for this policy is Enabled — it makes the super admin behave more like a regular admin, with elevation prompts before privileged actions.

PowerShell: Remote Enable/Disable

# Enable on a remote PC
Invoke-Command -ComputerName "REMOTE-PC" -ScriptBlock {
    Enable-LocalUser -Name "Administrator"
}

# Set a password remotely (replace with your secure method)
Invoke-Command -ComputerName "REMOTE-PC" -ScriptBlock {
    $password = ConvertTo-SecureString "YourPassword" -AsPlainText -Force
    Set-LocalUser -Name "Administrator" -Password $password
}

# Disable on a remote PC
Invoke-Command -ComputerName "REMOTE-PC" -ScriptBlock {
    Disable-LocalUser -Name "Administrator"
}

Best Practices (From the Tenable/STIG Baseline)

Security baselines (Tenable, DISA STIG) recommend: the built-in Administrator should remain disabled, Admin Approval Mode should be enabled as a safety net if it is activated, and the account should have a strong password set immediately upon any activation. For enterprise deployment, the Group Policy for Admin Approval Mode provides the safety net, and Intune can push the same configuration.

Frequently Asked Questions

How do I enable the super admin account in Windows 11?

Open Terminal (Admin) and run: net user Administrator /active:yes. The account is immediately active. Set a password immediately after — the built-in Administrator has no password by default.

How do I disable the super admin account in Windows 11?

Open Terminal (Admin) and run: net user Administrator /active:no. Or in PowerShell: Disable-LocalUser -Name "Administrator". Or through lusrmgr.msc: check “Account is disabled.”

What is a super admin account in Windows 11?

It’s the built-in Administrator — a hidden, disabled-by-default account that exists on every Windows installation. When enabled, it runs everything with full admin rights, bypasses UAC prompts, cannot be locked out, and has no password by default.

What is the difference between admin and super admin?

A regular admin account still gets UAC prompts and can be locked out. The built-in Administrator (super admin) bypasses UAC, cannot be locked out, cannot be deleted, and has no password by default. Regular admin is the safe default; super admin is the recovery tool.

Does the built-in Administrator account have a password by default?

No. The account is disabled by default AND has no password. If you enable it without setting one, anyone at the login screen can sign in with full admin rights. Always set a password immediately after enabling.

Is it safe to use the built-in Administrator account?

For short, specific tasks (recovery, troubleshooting): yes, if you set a password and disable the account afterward. For daily use: no. The account bypasses UAC, can’t be locked out, and every application it runs gets full admin rights with no security check.

Can I have two administrator accounts on Windows 11?

Yes. Windows 11 supports multiple administrator accounts. You can have your regular admin, a backup admin for recovery, and the built-in Administrator (which is a separate, hidden account in addition to any regular admins you’ve created).

How do I set a password for the built-in Administrator?

From an elevated Command Prompt: net user Administrator YourNewPassword. Or through lusrmgr.msc (right-click Administrator → Set Password). Do this immediately after enabling the account.

Why does my account say administrator but still ask for permission?

That’s User Account Control (UAC) working correctly. A regular administrator account still receives UAC prompts — that’s the security design. Only the built-in Administrator bypasses UAC. If you want an account that doesn’t prompt, you’re looking for the built-in Administrator (with all its risks).

Can the built-in Administrator account be locked out?

No. The built-in Administrator is exempt from account lockout policy. Failed login attempts do not lock it out. This is one reason it’s a security risk when enabled without a password.

How do I access the Administrator account if I have no admin accounts?

Boot into the Windows Recovery Environment (WinRE) by interrupting startup three times, go to Troubleshoot → Advanced options → Command Prompt, and run net user Administrator /active:yes. Restart and sign in as Administrator.

Can I rename the built-in Administrator account?

Yes, through lusrmgr.msc or the net user command, but it’s not recommended. Some applications and scripts expect the account to be named “Administrator.” If you rename it, some recovery tools and group policy scripts may not find it.

Does Windows 11 Home have the built-in Administrator?

Yes, the account exists on Windows 11 Home, but Home doesn’t include lusrmgr.msc (Local Users and Groups). Use the Command Prompt method: net user Administrator /active:yes.

How do I make my account an administrator in Windows 11?

Settings → Accounts → Family & other users → select the account → Change account type → change from Standard User to Administrator → OK. This gives admin rights with UAC prompts — the safe way. Don’t enable the hidden Administrator for this purpose.

What is Admin Approval Mode for the Built-in Administrator?

A Group Policy setting (Computer Configuration → Administrative Templates → Windows Components → User Account Control) that forces UAC prompts for the built-in Administrator. When enabled, the super admin behaves like a regular admin, asking before elevated actions. The recommended state is Enabled.

What is the difference between super admin in Windows and Google Workspace?

They are unrelated. Google Workspace “super admin” is a cloud-based role for managing a Google organization’s users and settings. Windows “built-in Administrator” is a local, offline account on a single PC. The name similarity is coincidental — this page covers only the Windows version.

Revision note. Updated September 2026/ The built-in Administrator account and its command-line management have been unchanged across all Windows versions since Vista. Microsoft’s “Administrator Protection” feature (Settings → Privacy & security → Windows Security → Account protection) adds an additional UAC-style approval for admin operations and is available on newer Windows 11 builds. If you have been searching for “super admin” and finding conflicting instructions, take heart: the account is real, the command is one line, and the password — the step every guide skips — is now the first thing you know to set.